Weakness (CWE)
CWE-667: Improper Locking
The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.
How to prevent it (1 mitigation)
-
Implementation
Use industry standard APIs to implement locking mechanism.
Source: MITRE CWE-667
188 results · Feed
-
Medium 6.2
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text exp…
-
Medium 5.5
Guests can trigger deadlock in Linux netback driver T[his CNA information record relates to multiple CVEs; the text exp…
-
Medium 5.5
A flaw was found in the Linux kernel's Layer 2 Tunneling Protocol (L2TP). A missing lock when clearing sk_user_data can…
-
Medium 4.7
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL po…
-
Unscored —
A race condition was found in the Linux kernel's IP framework for transforming packets (XFRM subsystem) when multiple c…
-
Unscored —
A deadlock issue was found in the AHCI controller device of QEMU. It occurs on a software reset (ahci_reset_port) while…
-
Unscored —
A race condition was found in the Linux kernel's watch queue due to a missing lock in pipe_resize_ring(). The specific …
-
High 7.8
A memory corruption vulnerability was addressed with improved locking. This issue is fixed in macOS Monterey 12.5, macO…
-
Unscored —
A flaw was found in the libvirt nwfilter driver. The virNWFilterObjListNumOfNWFilters method failed to acquire the driv…
-
Unscored —
A flaw was found in the libvirt libxl driver. A malicious guest could continuously reboot itself and cause libvirtd on …
-
Unscored —
A vulnerability was found in btrfs_alloc_tree_b in fs/btrfs/extent-tree.c in the Linux kernel due to an improper lock o…
-
Unscored —
An improper locking issue was found in the virStoragePoolLookupByTargetPath API of libvirt. It occurs in the storagePoo…
-
Medium 5.3
Improper Locking in JetBrains Kotlin
In JetBrains Kotlin before 1.6.0, it was not possible to lock dependencies for Multiplatform Gradle Projects.
-
Unscored —
A locking protection bypass flaw was found in some versions of gnome-shell as shipped within CentOS Stream 8, when the …
-
Medium 4.4
Improper locking in the Power Management Controller (PMC) for some Intel Chipset firmware before versions pmc_fw_lbg_c1…
-
High 7.5
Junos OS: MX Series and SRX Series: The flowd daemon will crash if the SIP ALG is enabled and specific SIP messages are processed
An Improper Locking vulnerability in the SIP ALG of Juniper Networks Junos OS on MX Series and SRX Series allows an unauthenticated networked attacker to cause a flowprocessing daemon (flowd) crash and thereby a Denial of Service (DoS). Continued receipt of t…
-
Medium 5.9
Missing release of locks in PJSIP
PJSIP is a free and open source multimedia communication library written in the C language implementing standard based protocols such as SIP, SDP, RTP, STUN, TURN, and ICE. In various parts of PJSIP, when error/failure occurs, it is found that the function re…
-
Medium 5.5
Deadlock in mutually recursive `tf.function` objects
TensorFlow is an open source platform for machine learning. In affected versions the code behind `tf.function` API can be made to deadlock when two `tf.function` decorated Python functions are mutually recursive. This occurs due to using a non-reentrant `Lock…
-
High 7.0
A race condition was addressed with improved locking. This issue is fixed in macOS Big Sur 11.2, Security Update 2021-0…
KEV Nov 3, 2021 -
Medium 6.5
Improper Locking in github.com/containers/storage
A deadlock vulnerability was found in 'github.com/containers/storage' in versions before 1.28.1. When a container image is processed, each layer is unpacked using `tar`. If one of those layers is not a valid `tar` archive this causes an error leading to an un…
-
Medium 5.9
Data race in va-ts
An issue was discovered in the va-ts crate before 0.0.4 for Rust. Because Demuxer<T> omits a required T: Send bound, a data race and memory corruption can occur.
-
High 7.5
Denial of Service in Gitea
An issue was discovered in Gitea through 1.11.5. An attacker can trigger a deadlock by initiating a transfer of a repository's ownership from one organization to another.
-
High 7.0
The fix for CVE-2019-11599, affecting the Linux kernel before 5.0.10 was not complete. A local user could use this flaw…
-
High 7.5CVE-2019-10072 EPSS 73%
Improper Locking in Apache Tomcat
The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients wer…
-
Medium 5.6
A race condition in perf_event_open() allows local attackers to leak sensitive data from setuid programs. As no relevan…
-
Medium 5.5
The kernel in Sun Solaris 8, 9, and 10, and OpenSolaris before snv_103, does not properly handle interaction between th…
-
Medium 4.7
Race condition in Linux 2.6, when threads are sharing memory mapping via CLONE_VM (such as linuxthreads and vfork), mig…
-
High 7.8
Windows 2000 allows local users to prevent the application of new group policy settings by opening Group Policy files w…